Fix Solr Auth Binding #29

nickumia-reisys · 2021-12-23T22:33:44Z

generate-env.sh now works whether you're using a KinD cluster or a real one in your kubeconfig

…rence

mogul

I'm still unclear on what the fix actually was... Curling from inside the Solr container? Changing the default Solr image in use? Please explain!

manifest.yml

…nces in readme

…s to only be in 8.11?

…fix/nginx-request-size

I reverted the variable in question.

…TTS/datagov-brokerpak-solr#29

nickumia-reisys

@mogul I don't know what caused the 'binding' process to fail prior to this PR. There were a lot of changes to this repo in this PR that may have effected it. Kubernetes token issues. Curl unable to reach API. EKS vs. KiND peculiarities. Either way, the repo has now been tested with KiND and with a real EKS cluster, so I have confidence that it will work this time.

TODO: Document how to manually test repo with a real EKS cluster. The steps are scattered throughout this repo and GSA/data.gov#3523. It just needs to be consolidated.

Related Repo Update: curl was installed in our base solr image https://github.com/GSA/catalog.data.gov/blob/feature/solr8/solr/Dockerfile#L11-L12

nickumia-reisys · 2021-12-29T14:50:38Z

examples.json-template

@@ -5,7 +5,8 @@
    "service_name": "solr-cloud",
    "service_id": "b9013a91-9ce8-4c18-8035-a135a8cd6ff9",
    "plan_id": "e35e9675-413f-4f42-83de-ad5003357e77",
-    "provision_params": {"solrJavaMem":"-Xms300m -Xmx300m", "solrMem":"1G", "solrCpu":"1000m", "cloud_name":"demo"},
+    "provision_params": {"solrJavaMem":"-Xms300m -Xmx300m", "solrMem":"1G", "solrCpu":"1000m", "cloud_name":"demo", "solrImageRepo":"ghcr.io/gsa/catalog.data.gov.solr", "solrImageTag":"8-curl"},


Use the new image with curl for tests.

nickumia-reisys · 2021-12-29T14:52:22Z

generate-env.sh

 CURRENT_CONTEXT=$(kubectl config current-context)
-SOLR_CLUSTER_CA_CERTIFICATE=$(kubectl config view --raw -o json | jq -r '.clusters[]| select(.name | contains("'${CURRENT_CONTEXT}'"))  .cluster["certificate-authority-data"]')
-SOLR_TOKEN=$(kubectl get secret $( kubectl get serviceaccount default -n default -o json | jq -r '.secrets[0].name' ) -n default -o json | jq -r .data.token)
+CURRENT_CLUSTER=$(kubectl config view --raw -o json | jq -r '.contexts[]| select(.name | contains("'"${CURRENT_CONTEXT}"'"))  .context.cluster')
+CURRENT_USER=$(kubectl config view --raw -o json | jq -r '.contexts[]| select(.name | contains("'"${CURRENT_CONTEXT}"'"))  .context.user')
+SOLR_CLUSTER_CA_CERTIFICATE=$(kubectl config view --raw -o json | jq -r '.clusters[]| select(.name | contains("'"${CURRENT_CLUSTER}"'"))  .cluster["certificate-authority-data"]')
+SOLR_TOKEN=$(echo -n `kubectl config view --raw -o json | jq -r '.users[]| select(.name | contains("'"${CURRENT_USER}"'"))  .user["token"]'` | base64 -w 0)
+SOLR_SERVER=$(kubectl config view --raw -o json | jq -r '.clusters[]| select(.name | contains("'"${CURRENT_CLUSTER}"'"))  .cluster["server"]')

-# We need the Docker-internal control plane URL to be resolved for the CSB
-# when running in a container
-SOLR_DOCKER_SERVER=$(kind get kubeconfig --internal --name=$(kind get clusters | grep datagov-broker-test) | grep server | cut -d ' ' -f 6-)
+SOLR_DOMAIN_NAME=${SOLR_DOMAIN_NAME:-ing.local.domain}

-# We need the localhost control plan URL to be used for direct access when we
-# work outside the CSB
-SOLR_LOCALHOST_SERVER=$(kind get kubeconfig --name=$(kind get clusters | grep datagov-broker-test) | grep server | cut -d ' ' -f 6-)
+if [[ "${CURRENT_CLUSTER}" == "kind-datagov-broker-test" ]]; then
+    # If the test cluster is in KinD we need the CSB to use 
+    # a control plane URL resolvable from inside the CSB Docker container
+    CURRENT_USER=kind-datagov-broker-test
+    SOLR_CP_SERVER=$(kind get kubeconfig --internal --name="$(kind get clusters | grep datagov-broker-test)" | grep server | cut -d ' ' -f 6-)
+    SOLR_TOKEN=$(kubectl get secret $(kubectl get secrets | grep -oh "default-token-[a-z]*\s") -o json | jq .data.token | tr -d '"')
+    if [[ "$SOLR_TOKEN" == "null" ]]; then
+        # The format of the secret is different if there are more than one token associated with a secret.
+        # The first token works reliably
+        SOLR_TOKEN=$(kubectl get secret $(kubectl get secrets | grep -oh "default-token-[a-z]*\s") -o json | jq .items[0].data.token | tr -d '"')
+    fi
+else
+    # Otherwise it's the same as the normal server control plane URL
+    SOLR_CP_SERVER=${SOLR_SERVER}
+fi


Set up repo to cooperate with either a KiND cluster or real EKS cluster.

nickumia-reisys · 2021-12-29T14:52:56Z

terraform/bind/main.tf

@@ -70,23 +70,20 @@ resource "null_resource" "manage_solr_user" {
    # Can't reuse containers because they are left in an unpredictable state after a single run
    # Wait for the command to run before deleting the container
    command = <<-EOF
-      kubectl --kubeconfig <(echo $KUBECONFIG | base64 -d) run temp1 --image=curlimages/curl --  \
+      kubectl --kubeconfig <(echo $KUBECONFIG | base64 -d) exec ${self.triggers.cloud_name}-solrcloud-0 --  curl \


curl to Solr API is now performed from within the solrcloud pod itself

nickumia-reisys · 2021-12-29T14:57:51Z

terraform/provision/main.tf

@@ -45,6 +45,7 @@ resource "helm_release" "solrcloud" {
      "replicas"                                   = var.replicas      # How many replicas you want
      "solrOptions.javaMemory"                     = var.solrJavaMem   # How much memory to give each replica
      "solrOptions.security.authenticationType"    = "Basic"
+      "ingressOptions.annotations.nginx\\.ingress\\.kubernetes\\.io/proxy-body-size" = "999m"


Port update from earlier release, 574336a#diff-ba41f8c4953fba843cf840ae370b5681502661992bf51cede0ea49d92187a6aeR45

mogul and others added 9 commits December 22, 2021 23:42

Factor out KinD-specific configuration

edb4012

generate-env.sh now works whether you're using a KinD cluster or a real one in your kubeconfig

Remove the need for permission to list namespaces

4215780

fix: ignore 'rm' error if file to delete does not exist

062a2ed

cleanup: remove reference to deleted file

f131250

new: get kube token from current context; update solr.server env refe…

7743719

…rence

new: update default solr image to 8.11; fix solr auth binding

25e2a70

cleanup: remove reference to deleted items

b041d78

update: local KiND to use solr operator 0.5.0

19032f9

revert: parameters to get KiND cluster to be functional

9430105

nickumia-reisys mentioned this pull request Dec 24, 2021

Solr 8 instance credentials are not bound on cloud.gov GSA/data.gov#3523

Closed

mogul previously requested changes Dec 24, 2021

View reviewed changes

manifest.yml Outdated Show resolved Hide resolved

nickumia-reisys added 9 commits December 28, 2021 10:30

fix/docs: get solr token from secrets for kind cluster; update refere…

4153ba8

…nces in readme

fix: I don't know how to describe this, but it works

a005fb7

revert: name of solr.server env var name

5b592cc

fix: explicitly call make .env

e814a05

fix: SOLR_TOKEN on github actions is a bit different; also, curl seem…

b476a03

…s to only be in 8.11?

new: try to use custom docker image with solr and curl

7760f0b

fix: SOLR_TOKEN would be 'null' if the first command fails, not unset

c44ea71

noop: test durability of tests..

8784d1f

port: fix from https://github.com/GSA/datagov-brokerpak-solr/tree/bug…

736fe2d

…fix/nginx-request-size

nickumia-reisys force-pushed the fix-solr8-suth-with-eks branch from e1c9ca5 to 736fe2d Compare December 28, 2021 21:57

fix: make option a string for terraform

d4c4e96

nickumia-reisys requested a review from FuhuXia December 28, 2021 22:11

FuhuXia approved these changes Dec 29, 2021

View reviewed changes

FuhuXia merged commit 63d04ac into main Dec 29, 2021

FuhuXia deleted the fix-solr8-suth-with-eks branch December 29, 2021 14:37

nickumia-reisys added a commit to GSA/catalog.data.gov that referenced this pull request Dec 29, 2021

new: install curl in Solr image to interact with API, related to GSA-…

cc0d403

…TTS/datagov-brokerpak-solr#29

nickumia-reisys commented Dec 29, 2021

View reviewed changes

mogul added the component/ssb label Mar 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Solr Auth Binding #29

Fix Solr Auth Binding #29

nickumia-reisys commented Dec 23, 2021

mogul left a comment

nickumia-reisys left a comment

nickumia-reisys Dec 29, 2021

nickumia-reisys Dec 29, 2021

nickumia-reisys Dec 29, 2021

nickumia-reisys Dec 29, 2021

Fix Solr Auth Binding #29

Fix Solr Auth Binding #29

Conversation

nickumia-reisys commented Dec 23, 2021

mogul left a comment

Choose a reason for hiding this comment

nickumia-reisys left a comment

Choose a reason for hiding this comment

nickumia-reisys Dec 29, 2021

Choose a reason for hiding this comment

nickumia-reisys Dec 29, 2021

Choose a reason for hiding this comment

nickumia-reisys Dec 29, 2021

Choose a reason for hiding this comment

nickumia-reisys Dec 29, 2021

Choose a reason for hiding this comment